ClawHub
Back to skill

Security audit

Openclaw Configurator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw configuration helper, with some operational cautions around daemon use and memory permissions.

Installers should review generated files before placing them in ~/.openclaw/workspace, avoid storing secrets in memory or profile files, and only run the daemon command if they intentionally want OpenClaw to keep running in the background. For memory directories, use directory-appropriate private permissions such as 700 rather than 600.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Warning
Location
SKILL.md:139
Finding

Mandatory Recommendation to Install a Persistent Background Daemon

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 139-142
Vulnerability Type: System persistence through daemon installation guidance
Risk Level: Medium

Vulnerable Code Snippet:

markdown
2. **Daemon Persistence**:
   - Use `openclaw onboard --install-daemon` to keep the assistant running as a background service.

Technical Analysis

The Skill instructs the agent to recommend installing OpenClaw as a persistent background daemon for public or semi-public channel configurations. A daemon continues operating beyond the interactive Skill invocation and may start automatically in later sessions.

The command is not executed directly by this package, and successful installation still requires the user to run it with whatever authorization the OpenClaw installer requires. Nevertheless, the recommendation is presented as an unconditional part of the public-channel setup rather than an optional operation requiring informed consent. This expands the configured agent's lifetime and attack surface beyond the immediate task.

Attack Path

  1. A user requests an OpenClaw configuration for a public or semi-public messaging channel.
  2. The Skill follows its mandatory security-recommendation workflow.
  3. The generated guidance tells the user to run openclaw onboard --install-daemon.
  4. The user executes the command under their account or with any elevated authorization requested by the installer.
  5. OpenClaw is registered as a persistent background service.
  6. The service continues running after the configuration session, retaining access available to its service account and exposed integrations.

Impact Assessment

The installation can establish cross-session persistence for OpenClaw and increase exposure to channel-originated messages, configuration errors, or later compromise. The resulting privileges are limited to those assigned to the installed service and its account; the audited files do ...[truncated 236 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the unconditional requirement to recommend daemon installation.
  • Present background-service installation only when the user explicitly requests continuous operation.
  • Explain the persistence behavior, startup mechanism, service identity, filesystem access, network exposure, and operational risks before installation.
  • Require explicit user confirmation immediately before providing the installation command.
  • Configure the service under a dedicated, unprivileged account with access restricted to the minimum required workspace and integrations.
  • Avoid administrative or root installation unless it is demonstrably required.
  • Provide documented commands for inspecting, stopping, disabling, and uninstalling the daemon.
  • Recommend access controls such as dmPolicy="pairing" and a restrictive allowFrom list before enabling persistent public-channel operation.
  • Include log rotation, update procedures, and periodic review of enabled channels and tools.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:155
Finding

Invalid Permission Mode Recommended for the Memory Directory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 155-157
Vulnerability Type: Insecure filesystem permission guidance
Risk Level: Low

Vulnerable Code Snippet:

markdown
5. **Memory File Permissions**:
   - Recommend setting file permissions on `~/.openclaw/workspace/memory/` to `600` (owner read/write only).
   - Recommend git-ignoring the `memory/` directory if the workspace is a public repo.

Technical Analysis

Permission mode 600 is appropriate for a sensitive regular file but not for a directory. On POSIX-compatible systems, a directory requires its execute bit to permit traversal and access to entries within it. Setting ~/.openclaw/workspace/memory/ to 600 removes execute permission for every user, including the owner.

Consequently, OpenClaw may be unable to enumerate, read, create, or update memory files even though the owner has nominal read and write permissions on the directory. Operators responding to these failures may apply unnecessarily broad permissions, potentially weakening memory confidentiality.

Attack Path

  1. A user follows the Skill's permission-hardening recommendation.
  2. The user applies mode 600 to ~/.openclaw/workspace/memory/.
  3. The directory loses its traversal permission.
  4. OpenClaw fails to access or update files under the memory directory.
  5. Persistent-memory operations become unavailable, or the user attempts to restore functionality by applying overly permissive modes.

No direct privilege acquisition is demonstrated by this issue. The primary exploitation consequence is denial of access to memory data and the possibility of secondary exposure if an operator responds by weakening permissions excessively.

Impact Assessment

The direct impact is loss of availability and integrity of memory-management operations. The agent may fail to retrieve established preferences, record requested memories, or maintain consistent state. Existing ...[truncated 298 chars]

Remediation
View remediation

Remediation Suggestions

  • Recommend mode 700 for ~/.openclaw/workspace/memory/, giving only the owner permission to list, modify, and traverse the directory.
  • Recommend mode 600 for sensitive regular files stored inside the directory.
  • Provide type-aware example commands, such as:
    sh
    chmod 700 ~/.openclaw/workspace/memory
find ~/.openclaw/workspace/memory -type d -exec chmod 700 {} \;
find ~/.openclaw/workspace/memory -type f -exec chmod 600 {} \;
  • Advise users to verify ownership before changing permissions and ensure the directory belongs to the account running OpenClaw.
  • Retain the recommendation to exclude private memory from public repositories, while clarifying that .gitignore does not remove files already committed to version control.
  • Recommend encrypted storage or a secrets manager for sensitive values; memory files should not contain passwords, API keys, private keys, financial account numbers, or similar secrets.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
- MEMORY.md should store references (e.g., "user banking provider: ICBC"), not account numbers.

5. **Memory File Permissions**:
   - Recommend setting file permissions on `~/.openclaw/workspace/memory/` to `600` (owner read/write only).
   - Recommend git-ignoring the `memory/` directory if the workspace is a public repo.

### Multi-Channel Isolation

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

Lines L039-L040 instruct the assistant to refer users to official documentation rather than guessing when uncertain about field values. However, L167 requires every generated file to conform to schemas/output-schema.json, a local schema that is not introduced in the specification section and may force behavior beyond the stated 'authoritative references.' This is an intent/documentation inconsistency within the skill instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.